Build artifacts tagged with commit SHA, git tag, or semantic version; Docker images use SHA not latest

Docker images tagged exclusively as latest make it impossible to pinpoint which code version is running in production, roll back to a known-good build, or audit what changed between deployments. SLSA Build-L2 requires traceable artifact provenance; SSDF DS.1 requires unique build identifiers. Without SHA or semantic version tagging, a failed deployment becomes a debugging exercise because latest is overwritten with each push — the previous good build is gone.

Tag Docker images with the commit SHA or semantic version in your CI/CD workflow. Never push latest as the only tag.

# .github/workflows/deploy.yml
- name: Build and push image
  run: |
    COMMIT_SHA=${{ github.sha }}
    docker build -t myregistry/myapp:${COMMIT_SHA:0:7} .
    docker push myregistry/myapp:${COMMIT_SHA:0:7}

For semver-based projects:

- run: |
    VERSION=$(npm pkg get version | tr -d '"')
    docker build -t myregistry/myapp:${VERSION} .
    docker push myregistry/myapp:${VERSION}

Update your deployment manifests or Helm values to reference the specific tag, not latest. Store the mapping of version → commit in release notes or GitHub Releases.